Computer-based systems with programmed automatic real-time updatable browsing data objects and activity data objects and methods of use thereof

ABSTRACT

In order to provide improved matching of records between different sources, systems and methods include generating a data link between a stored interaction profile of the user and activity data records that identify activities performed by the user. Online interaction data associated with the user is received, including tracking data indicative of online interactions with content. The online interaction data is stored in the stored interaction profile associated with the user. An activity model is used to predict correlation parameters representing groupings of online interactions of the online interaction data with activities performed by the user, where the prediction is based on the tracking data and each activity in the interaction profile. The interaction profile is updated with the groupings and user activities are authenticated based on the interaction profile.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialthat is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent files or records, but otherwise reserves all copyrightrights whatsoever. The following notice applies to the software and dataas described below and in drawings that form a part of this document:Copyright, Capital One Services, LLC, All Rights Reserved.

FIELD OF TECHNOLOGY

The present disclosure generally relates to computer-based systemsconfigured for one or more novel technological solutions of systems andmethods for automatic real-time updatable browsing data objects andactivity data objects.

BACKGROUND OF TECHNOLOGY

A computer network system may include a group of computers (e.g.,clients, servers, smart routers) and other computing hardware devicesthat are linked together through one or more communication channels tofacilitate communication and resource-sharing, via one or morespecifically programmed graphical user interfaces (GUIs), among a widerange of users.

Certain online behaviors, such as clicks and selections, within a GUI ofsome tools may be tracked by those tools. However, behaviors beyond theGUI of those tools are unknown to the tools. Thus, any correlation toactivities beyond such a GUI is also unknown.

SUMMARY OF DESCRIBED SUBJECT MATTER

In some embodiments, the present disclosure provides an exemplarytechnically improved computer-based method that includes at least thefollowing steps of receiving, by at least one processor, anauthentication request in response to a user selection at a usercomputing device associated with a user. Generating, by the at least oneprocessor, at least one data link between: i) a stored interactionprofile of the user and ii) at least one activity data record thatidentifies at least one entity-related activity performed by the user,where the stored interaction profile is stored in at least one profiledatabase, and where the at least one activity data record includes: i)an activity type indicator that indicates a type of each respectiveentity-related activity of the at least one entity-related activity, ii)a related entity indicator that indicates at least one entity associatedwith each respective entity-related activity of the at least oneentity-related activity, and iii) a date indicator that indicates a dateassociated with each respective entity-related activity of the at leastone entity-related activity. Receiving, by the at least one processor,at least one online interaction data object associated with the user,where each respective online interaction data object of the at least oneonline interaction data object includes tracking data indicative of arespective at least one online interaction with content associated witha respective third-party merchant, and where the tracking dataassociated with each respective at least one online interactionincludes: i) a third-party merchant indicator indicating the respectivethird-party merchant, ii) a product indicator indicating a productassociated with the content, and iii) an interaction date indicatorindicating a date of each online interaction. Storing, by the at leastone processor, the at least one online interaction data object in thestored interaction profile associated with the user. Utilizing, by theat least one processor, an activity model to predict at least onecorrelation parameter representing a respective grouping of onlineinteractions of the at least one online interaction data object that arecorrelated with a respective one or more activities of the activity datarecord using the at least one data link, where the prediction of thecorrelation parameter is based at least in part on the tracking data ofeach respective online interaction data object of the at least oneonline interaction data object associated with the user and each recordof account activities in the at least one activity data recordassociated with the user. Updating the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link. Causing to display, by theat least one processor, an authentication of the user selection inresponse to the authentication request based on the respective groupingof online interactions.

In some embodiments, the present disclosure provides an exemplarytechnically improved computer-based method that includes at least thefollowing steps of receiving, by at least one processor, an onlineinteraction by a user with content associated with a third-partymerchant, where the online interaction includes tracking data, and wherethe tracking data includes: i) a third-party merchant indicatorindicating the third-party merchant associated, ii) a product indicatorindicating a product associated with the content, and iii) aninteraction date indicator indicating a date of each online interaction.Storing, by the at least one processor, the online interaction in anonline interaction data object associated with the user. Utilizing, bythe at least one processor, an account activity model to predict acorrelation parameter representing a grouping of the online interactionwith one or more entity-related activities of at least one activity datarecord associated with the user based at least in part on the trackingdata and each entity-related activity in the at least one activity datarecord, where each entity-related activity includes: i) an activity typeindicator that indicates a type of each respective entity-relatedactivity of the one or more entity-related activities, ii) a relatedentity indicator that indicates at least one entity associated with eachrespective entity-related activity of the one or more entity-relatedactivities, and iii) a date indicator that indicates a date associatedwith each respective entity-related activity of the one or moreentity-related activities. Updating the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link. Causing to display, by theat least one processor, an authentication of a user selection based onthe correlation parameter representing the grouping of the onlineinteraction with the one or more entity-related activities.

In some embodiments, the present disclosure provides an illustrativecomputer-based system that includes at least the following components ofat least one activity database configured to store an at least oneactivity data record associated with a user, at least one profiledatabase configured to store a stored interaction profile associatedwith the user, and at least one processor in communication with theaccount database and the online interaction database. The at least oneprocessor is configured to: receive an authentication request inresponse to a user selection at a user computing device associated witha user; generate at least one data link between: i) a stored interactionprofile of the user and ii) at least one activity data record thatidentifies at least one entity-related activity performed by the user;where the stored interaction profile is stored in the at least oneprofile database; where the at least one activity data record includes:i) an activity type indicator that indicates a type of each respectiveentity-related activity of the at least one entity-related activity, ii)a related entity indicator that indicates at least one entity associatedwith each respective entity-related activity of the at least oneentity-related activity, and iii) a date indicator that indicates a dateassociated with each respective entity-related activity of the at leastone entity-related activity; receive at least one online interactiondata object associated with the user; where each respective onlineinteraction data object of the at least one online interaction dataobject includes tracking data indicative of a respective at least oneonline interaction with content associated with a respective third-partymerchant; where the tracking data associated with each respective atleast one online interaction includes: i) a third-party merchantindicator indicating the respective third-party merchant, ii) a productindicator indicating a product associated with the content, and iii) aninteraction date indicator indicating a date of each online interaction;store the at least one online interaction data object in the storedinteraction profile associated with the user; utilize an activity modelto predict at least one correlation parameter representing a respectivegrouping of online interactions of the at least one online interactiondata object that are correlated with a respective one or more activitiesof the data record using the at least one data link; where theprediction of the correlation parameter is based at least in part on thetracking data of each respective online interaction data object of theat least one online interaction data object associated with the user andeach record of account activities in the at least one activity datarecord associated with the user; update the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link; and cause to display anauthentication of the user selection in response to the authenticationrequest based on the respective grouping of online interactions.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of the present disclosure can be further explainedwith reference to the attached drawings, wherein like structures arereferred to by like numerals throughout the several views. The drawingsshown are not necessarily to scale, with emphasis instead generallybeing placed upon illustrating the principles of the present disclosure.Therefore, specific structural and functional details disclosed hereinare not to be interpreted as limiting, but merely as a representativebasis for teaching one skilled in the art to variously employ one ormore illustrative embodiments of.

FIGS. 1-8 show one or more schematic flow diagrams and certaincomputer-based architectures which are illustrative of some exemplaryaspects of at least some embodiments of the present disclosure.

DETAILED DESCRIPTION

Various detailed embodiments of the present disclosure, taken inconjunction with the accompanying figures, are disclosed herein;however, it is to be understood that the disclosed embodiments aremerely illustrative. In addition, each of the examples given inconnection with the various embodiments of the present disclosure isintended to be illustrative, and not restrictive.

Throughout the specification, the following terms take the meaningsexplicitly associated herein, unless the context clearly dictatesotherwise. The phrases “in one embodiment” and “in some embodiments” asused herein do not necessarily refer to the same embodiment(s), thoughit may. Furthermore, the phrases “in another embodiment” and “in someother embodiments” as used herein do not necessarily refer to adifferent embodiment, although it may. Thus, as described below, variousembodiments may be readily combined, without departing from the scope orspirit of the present disclosure.

In addition, the term “based on” is not exclusive and allows for beingbased on additional factors not described, unless the context clearlydictates otherwise. In addition, throughout the specification, themeaning of “a,” “an,” and “the” include plural references. The meaningof “in” includes “in” and “on.”

It is understood that at least one aspect or functionality of variousembodiments described herein can be performed in real-time anddynamically. As used herein, the term “real-time” is directed to anevent or action that can occur instantaneously or almost instantaneouslyin time when another event or action has occurred. For example, the“real-time processing,” “real-time computation,” and “real-timeexecution” all pertain to the performance of a computation during theactual time that the related physical process (e.g., a user interactingwith an application on a mobile device) occurs, in order that results ofthe computation can be used in guiding the physical process.

As used herein, the term “dynamically” and term “automatically,” andtheir logical and linguistic relatives or derivatives, mean that certainevents and actions can be triggered or occur without any humanintervention. In some embodiments, events and actions in accordance withthe present disclosure can be in real-time or based on a predeterminedperiodicity of at least one of: nanosecond, several nanoseconds,millisecond, several milliseconds, second, several seconds, minute,several minutes, hourly, several hours, daily, several days, weekly,monthly, etc.

As used herein, the term “runtime” corresponds to any behavior that isdynamically determined during an execution of a software application orat least a portion of software application.

In some embodiments, specially programmed computing systems withassociated devices are configured to operate in the distributed networkenvironment, communicating with one another over one or more suitabledata communication networks (e.g., the Internet, satellite, etc.) andutilizing one or more suitable data communication protocols or modessuch as, without limitation, IPX/SPX, X.25, AX.25, AppleTalk™, TCP/IP(e.g., HTTP), near-field wireless communication (NFC), RFID, Narrow BandInternet of Things (NBIOT), 3G, 4G, 5G, GSM, GPRS, WiFi, WiMax, CDMA,satellite, ZigBee, and other suitable communication modes. In someembodiments, the NFC can represent a short-range wireless communicationstechnology in which NFC-enabled devices are “swiped,” “bumped,” “tap” orotherwise moved in close proximity to communicate. In some embodiments,the NFC could include a set of short-range wireless technologies,typically requiring a distance of 10 cm or less. In some embodiments,the NFC may operate at 13.56 MHz on ISO/IEC 18000-3 air interface and atrates ranging from 106 kbit/s to 424 kbit/s. In some embodiments, theNFC can involve an initiator and a target; the initiator activelygenerates an RF field that can power a passive target. In someembodiments, this can enable NFC targets to take very simple formfactors such as tags, stickers, key fobs, or cards that do not requirebatteries. In some embodiments, the NFC's peer-to-peer communication canbe conducted when a plurality of NFC-enable devices (e.g., smartphones)within close proximity of each other.

The material disclosed herein may be implemented in software or firmwareor a combination of them or as instructions stored on a machine-readablemedium, which may be read and executed by one or more processors. Amachine-readable medium may include any medium or mechanism for storingor transmitting information in a form readable by a machine (e.g., acomputing device). For example, a machine-readable medium may includeread only memory (ROM); random access memory (RAM); magnetic diskstorage media; optical storage media; flash memory devices; electrical,optical, acoustical or other forms of propagated signals (e.g., carrierwaves, infrared signals, digital signals, etc.), and others.

As used herein, the terms “computer engine” and “engine” identify atleast one software component or a combination of at least one softwarecomponent and at least one hardware component which are designed,programmed, or configured to manage or control other software andhardware components (such as the libraries, software development kits(SDKs), objects, etc.).

Examples of hardware elements may include processors, microprocessors,circuits, circuit elements (e.g., transistors, resistors, capacitors,inductors, and so forth), integrated circuits, application specificintegrated circuits (ASIC), programmable logic devices (PLD), digitalsignal processors (DSP), field programmable gate array (FPGA), logicgates, registers, semiconductor device, chips, microchips, chip sets,and so forth. In some embodiments, the one or more processors may beimplemented as a Complex Instruction Set Computer (CISC) or ReducedInstruction Set Computer (RISC) processors; x86 instruction setcompatible processors, multi-core, or any other microprocessor orcentral processing unit (CPU). In various implementations, the one ormore processors may be dual-core processor(s), dual-core mobileprocessor(s), and so forth.

Computer-related systems, computer systems, and systems, as used herein,include any combination of hardware and software. Examples of softwaremay include software components, programs, applications, operatingsystem software, middleware, firmware, software modules, routines,subroutines, functions, methods, procedures, software interfaces,application program interfaces (API), instruction sets, computer code,computer code segments, words, values, symbols, or any combinationthereof. Determining whether an embodiment is implemented using hardwareelements or software elements or both may vary in accordance with anynumber of factors, such as desired computational rate, power levels,heat tolerances, processing cycle budget, input data rates, output datarates, memory resources, data bus speeds and other design or performanceconstraints.

One or more aspects of at least one embodiment may be implemented byrepresentative instructions stored on a machine-readable medium whichrepresents various logic within the processor, which when read by amachine causes the machine to fabricate logic to perform the techniquesdescribed herein. Such representations, known as “IP cores” may bestored on a tangible, machine readable medium and supplied to variouscustomers or manufacturing facilities to load into the fabricationmachines that make the logic or processor. Of note, various embodimentsdescribed herein may, of course, be implemented using any appropriatehardware and computing software languages (e.g., C++, Objective-C,Swift, Java, JavaScript, Python, Perl, QT, etc.).

In some embodiments, one or more illustrative embodiments ofcomputer-based systems of the present disclosure may include or beincorporated, partially or entirely into at least one personal computer(PC), laptop computer, ultra-laptop computer, tablet, touch pad,portable computer, handheld computer, palmtop computer, personal digitalassistant (PDA), cellular telephone, combination cellular telephone,PDA, television, smart device (e.g., smart phone, smart tablet or smarttelevision), mobile internet device (MID), messaging device, datacommunication device, and so forth.

As used herein, the term “server” should be understood to refer to aservice point which provides processing, database, and communicationfacilities. By way of example, and not limitation, the term “server” canrefer to a single, physical processor with associated communications anddata storage and database facilities, or it can refer to a networked orclustered complex of processors and associated network and storagedevices, as well as operating software and one or more database systemsand application software that support the services provided by theserver. Cloud servers are examples.

In some embodiments, as detailed herein, one or more illustrativeembodiments of computer-based systems of the present disclosure mayobtain, manipulate, transfer, store, transform, generate, or output anydigital object or data unit (e.g., from inside or outside of aparticular application) that can be in any suitable form such as,without limitation, a file, a contact, a task, an email, a tweet, a map,an entire application (e.g., a calculator), etc. In some embodiments, asdetailed herein, one or more illustrative embodiments of computer-basedsystems of the present disclosure may be implemented across one or moreof various computer platforms such as, but not limited to: (1) AmigaOS,AmigaOS 4, (2) FreeBSD, NetBSD, OpenBSD, (3) Linux, (4) MicrosoftWindows, (5) OpenVMS, (6) OS X (Mac OS), (7) OS/2, (8) Solaris, (9)Tru64 UNIX, (10) VM, (11) Android, (12) Bada, (13) BlackBerry OS, (14)Firefox OS, (15) iOS, (16) Embedded Linux, (17) Palm OS, (18) Symbian,(19) Tizen, (20) WebOS, (21) Windows Mobile, (22) Windows Phone, (23)Adobe AIR, (24) Adobe Flash, (25) Adobe Shockwave, (26) Binary RuntimeEnvironment for Wireless (BREW), (27) Cocoa (API), (28) Cocoa Touch,(29) Java Platforms, (30) JavaFX, (31) JavaFX Mobile, (32) MicrosoftXNA, (33) Mono, (34) Mozilla Prism, XUL and XULRunner, (35) .NETFramework, (36) Silverlight, (37) Open Web Platform, (38) OracleDatabase, (39) Qt, (40) SAP NetWeaver, (41) Smartface, (42) Vexi, and(43) Windows Runtime.

In some embodiments, illustrative embodiments of computer-based systemsof the present disclosure may be configured to utilize hardwiredcircuitry that may be used in place of or in combination with softwareinstructions to implement features consistent with principles of thedisclosure. Thus, implementations consistent with principles of thedisclosure are not limited to any specific combination of hardwarecircuitry and software. For example, various embodiments may be embodiedin many different ways as a software component such as, withoutlimitation, a stand-alone software package, a combination of softwarepackages, or it may be a software package incorporated as a “tool” in alarger software product.

For example, exemplary software specifically programmed in accordancewith one or more principles of the present disclosure may bedownloadable from a network, for example, a website, as a stand-aloneproduct or as an add-in package for installation in an existing softwareapplication. For example, exemplary software specifically programmed inaccordance with one or more principles of the present disclosure mayalso be available as a client-server software application, or as aweb-enabled software application. For example, exemplary softwarespecifically programmed in accordance with one or more principles of thepresent disclosure may also be embodied as a software package installedon a hardware device.

In some embodiments, illustrative embodiments of computer-based systemsof the present disclosure may be configured to handle numerousconcurrent users that may be, but is not limited to, at least 100 (e.g.,but not limited to, 100-999), at least 1,000 (e.g., but not limited to,1,000-9,999), at least 10,000 (e.g., but not limited to, 10,000-99,999),at least 100,000 (e.g., but not limited to, 100,000-999,999), at least1,000,000 (e.g., but not limited to, 1,000,000-9,999,999), at least10,000,000 (e.g., but not limited to, 10,000,000-99,999,999), at least100,000,000 (e.g., but not limited to, 100,000,000-999,999,999), atleast 1,000,000,000 (e.g., but not limited to,1,000,000,000-999,999,999,999), and so on.

In some embodiments, illustrative embodiments of computer-based systemsof the present disclosure may be configured to output to distinct,specifically programmed graphical user interface implementations of thepresent disclosure (e.g., a desktop, a web app., etc.). In variousimplementations of the present disclosure, a final output may bedisplayed on a displaying screen which may be, without limitation, ascreen of a computer, a screen of a mobile device, or the like. Invarious implementations, the display may be a holographic display. Invarious implementations, the display may be a transparent surface thatmay receive a visual projection. Such projections may convey variousforms of information, images, or objects or combinations thereof. Forexample, such projections may be a visual overlay for a mobile augmentedreality (MAR) application.

In some embodiments, illustrative embodiments of computer-based systemsof the present disclosure may be configured to be utilized in variousapplications which may include, but not limited to, gaming,mobile-device games, video chats, video conferences, live videostreaming, video streaming and augmented reality applications,mobile-device messenger applications, and others similarly suitablecomputer-device applications.

As used herein, the term “mobile electronic device,” or the like, mayrefer to any portable electronic device that may or may not be enabledwith location tracking functionality (e.g., MAC address, InternetProtocol (IP) address, or the like). For example, a mobile electronicdevice can include, but is not limited to, a mobile phone, PersonalDigital Assistant (PDA), Blackberry™, Pager, Smartphone, or any otherreasonable mobile electronic device.

As used herein, the terms “proximity detection,” “locating,” “locationdata,” “location information,” and “location tracking” refer to any formof location tracking technology or locating method that can be used toprovide a location of, for example, a particular computing system of thepresent disclosure or any associated computing devices, based at leastin part on one or more of the following techniques and devices, withoutlimitation: accelerometer(s), gyroscope(s), Global Positioning Systems(GPS); GPS accessed using Bluetooth™; GPS accessed using any reasonableform of wireless or non-wireless communication or combination thereof,WiFi™ server location data; Bluetooth™ based location data;triangulation such as, but not limited to, network based triangulation,WiFi™ server information based triangulation, Bluetooth™ serverinformation based triangulation; Cell Identification basedtriangulation, Enhanced Cell Identification based triangulation,Uplink-Time difference of arrival (U-TDOA) based triangulation, Time ofarrival (TOA) based triangulation, Angle of arrival (AOA) basedtriangulation; techniques and systems using a geographic coordinatesystem such as, but not limited to, longitudinal and latitudinal based,geodesic height based, Cartesian coordinates based; Radio FrequencyIdentification such as, but not limited to, Long range RFID, Short rangeRFID; using any form of RFID tag such as, but not limited to active RFIDtags, passive RFID tags, battery assisted passive RFID tags; or anyother reasonable way to determine location. For ease, at times the abovevariations are not listed or are only partially listed; this is in noway meant to be a limitation.

As used herein, the terms “cloud,” “Internet cloud,” “cloud computing,”“cloud architecture,” and similar terms correspond to at least one ofthe following: (1) a large number of computers connected through areal-time communication network (e.g., Internet); (2) providing theability to run a program or application on many connected computers(e.g., physical machines, virtual machines (VMs)) at the same time; (3)network-based services, which appear to be provided by real serverhardware, and are in fact served up by virtual hardware (e.g., virtualservers), simulated by software running on one or more real machines(e.g., allowing to be moved around and scaled up (or down) on the flywithout affecting the end user).

In some embodiments, the illustrative embodiments of computer-basedsystems of the present disclosure may be configured to securely storeand transmit data by utilizing one or more of encryption techniques(e.g., private/public key pair, Triple Data Encryption Standard (3DES),block cipher algorithms (e.g., IDEA, RC2, RC5, CAST and Skipjack),cryptographic hash algorithms (e.g., MD5, RIPEMD-160, RTRO, SHA-1,SHA-2, Tiger (TTH), WHIRLPOOL, RNGs).

The aforementioned examples are, of course, illustrative and notrestrictive.

As used herein, the term “user” shall have a meaning of at least oneuser. In some embodiments, the terms “user”, “subscriber” “consumer” or“customer” should be understood to refer to a user of an application orapplications as described herein or a consumer of data supplied by adata provider. By way of example, and not limitation, the terms “user”or “subscriber” can refer to a person who receives data provided by thedata or service provider over the Internet in a browser session, or canrefer to an automated software application which receives the data andstores or processes the data.

As used herein, the terms “and” and “or” may be used interchangeably torefer to a set of items in both the conjunctive and disjunctive in orderto encompass the full description of combinations and alternatives ofthe items. By way of example, a set of items may be listed with thedisjunctive “or”, or with the conjunction “and.” In either case, the setis to be interpreted as meaning each of the items singularly asalternatives, as well as any combination of the listed items.

FIGS. 1 through 8 illustrate systems and methods of determining acorrelation between web-based activity data representing web-basedbehaviors with external activity data objects representing externalactivities for automatic real-time updates to browsing data objects. Thefollowing embodiments provide technical solutions and technicalimprovements that overcome technical problems, drawbacks or deficienciesin the technical fields involving record resolution and correlation,record discovery, and database interoperability. As explained in moredetail, below, technical solutions and technical improvements hereininclude aspects of improved activity detection and recognition, andimproved database interoperability to correlate web-based activitieswith non-web-based activities. Based on such technical features, furthertechnical benefits become available to users and operators of thesesystems and methods. Moreover, various practical applications of thedisclosed technology are also described, which provide further practicalbenefits to users and operators that are also new and usefulimprovements in the art.

Herein, “web-based” refers to actions, activities, behaviors, content,and data related to one or more platform existing on the world-wide-webor the Internet. Meanwhile, “external” refers to actions, activities,behaviors, content, and data related to one or more platforms differentfrom the aforementioned web-based platforms.

FIG. 1 is a block diagram of an illustrative computer-based system forsocial media data grouping in accordance with one or more embodiments ofthe present disclosure.

In some embodiments, a profile database 105 is in communication with auser computing device 103 and a user account database 104 for groupingof user activities, e.g., on the Internet, such as on a social network,and user data 102, such as, e.g., user transaction data includingfinancial transaction history data stored in the account database 104.In some embodiments, the profile database 105 may comparecharacteristics of activity data objects of the user data 102 withonline behavior data 101 received from the user computing device 103 tomatch online behaviors and activities that are potentially related totransactions or other external or offline activities involving the user.

In some embodiments, the user computing device 103 is in communicationwith an Internet platform 130 such as, e.g., a web browser, applicationor other Internet platform 130 such that a user may browse websites,blogs, social networks, and other web-based content. In someembodiments, the profile database 105, via the user computing device 103may recognize the content appearing on a screen of the user computingdevice 103 using, e.g., an activity recognition system 110.

For example, in some embodiments, a web browser on the user computingdevice 103 may include a browser extension that detects content andtransmits an online behavior data 101 associated with the userinteraction with the content to a content detector 111 of the activityrecognition system 110. In another example, the user interactions with,e.g., web-based content may be within an application stored on the usercomputing device 103, such as, e.g., a social media application, aweb-browser, or other application having content detection functionalitysuch that the application may transmit the indications of userinteraction. In another example, content detection is embedded in orprovided by, e.g., social media analytics, on the internet platform 130using, e.g., a suitable software development kit (SDK) for engaging withthe social media service or other internet platform 130.

In some embodiments, the content detector 111 itself is located on theuser computing device 103, for example, in a memory of the usercomputing device 103. For example, a browser extension, such as thebrowser extension described above, may include the content detector 111to detect and record user interaction with content to create the onlinebehavior data 101. The content detector 111 at the user computing device103 may then transmit the online behavior data 101 to the profiledatabase 105. Alternatively, or in addition, the content detector 111may be located on the internet platform 130, e.g., as part of a socialmedia SDK to cause the internet platform 130 to collect and transmit theonline behavior data 101 to the profile database 105.

In some embodiments, the content detector 111 may include, e.g., imagerecognition utilizing, e.g., machine learning classifiers, such as aneural network (e.g., convolutional neural network (CNN), recurrentneural network (RNN), artificial neural network (ANN) or other neuralnetwork), a support vector machine, k-Nearest Neighbor, an autoencoder,decision trees, or other machine learning classifier to classify imagesof the web-based content. The content detector 111 may also include,e.g., text recognition or natural language processing by utilizing,e.g., machine learning classifiers, such as those described above fortext recognition and parsing to understand text of the web-basedcontent.

In some embodiments, the content detector 111 includes a text parsingalgorithm to identify matches to a dictionary of particular words,phrases or both, such as, e.g., brand names, company names, organizationnames, products, persons, or other words or phrases. In someembodiments, the content detector 111 may include a tag recognitionalgorithm to identify, e.g., tags such as hypertext markup language(HTML) tags. Thus, in some embodiments, where the content includes,e.g., an advertisement, the content may include tags identifyingadvertisement details such as an associated merchant, a product, aservice, among other advertisement details. Using, e.g., text parsing ortag recognition or a combination thereof, the content detector 111 mayrecognize the advertisement details to identify, e.g., sales, products,merchants, among other information.

In some embodiments, the content detector 111 may directly identifycontent without the use of tags or text parsing. For example, thecontent detector 111 may be a software development kit (SDK) function,such as, e.g., an embedded SDK or embedded mobile SDK that is embeddedinto an application, webpage, service, platform, or other contentmanagement or delivery system. The embedded SDK may includefunctionality that automatically receives data regarding, e.g.,advertisements, or other content, such as content related to, e.g.,brand names, company names, organization names, products, persons, orother content and third-parties. For example, a social media platform ornetwork may embed the SDK associated with the content detector 111 suchthat any user interaction with content of interest is automaticallyprovided to the content detector 111.

In some embodiments, content of interest that the content detector 111is configured to detect may include, e.g., advertisements, brandedcontent, sponsored content, influencer generated content, contentassociated with a selected subject (e.g., news content, political newscontent, business news content, local news content, media news content,events, meetings, contact information, or other similar content, amongothers and combinations thereof) or other content of interest andcombinations thereof. In some embodiments, the content of interest maybe selectable or configurable by a user or administrator. In someembodiments, the content detector 111 is configured to detect and returndata regarding the content of interest as it appears in, e.g., awebsite, a blog post, a social media feed, a real-simple-syndication(RSS) feed, search engine results, video or audio content, among othermediums and combinations thereof. Accordingly, in some embodiments, thecontent detector 111 may receive, e.g., in real-time, a user'sinteraction with content of interest using, e.g., real-time text, tagparsing or a combination thereof, embedded SDK functionality, or othertechniques. In some embodiments, where the content detector 111 employstext, tag parsing or a combination thereof, the content detector 111 maycontinually detect user interactions with content and process thecontent being interacted with to identify content of interest. However,where the content detector 111 is employed in an embedded SDK, thecontent detector 111 may rely on host service to receive an indicationthat the user has interacted with the content of interest.

In some embodiments, the content detector 111 may detect, automaticallyand in real-time, that the content with which the user is or wasinteracting is associated with one or more of a set of particularentities or products and services using, e.g., the machine learningclassifiers, text parsing or a combination thereof as described above.For example, the content detector 111 may detect, e.g., an onlinebehavior data 101 from the user interaction with the content, including,e.g., an activity type indicator that indicates a type of userinteraction, an entity-related indicator that indicates an entityassociated with the content, and a data indicator that indicates a dateof the interaction. Upon receiving or producing the online behavior data101, the content detector 111 may determine whether the content includescontent associated with an entity, product or service of the set ofparticular entities, products and services. Where the content isassociated with one or more of the entities, products, services orcombinations thereof in the set, the content detector 111 may triggerthe activity recognition system 110 to group the interaction with one ormore activity data objects of the user data 102 in the account database104.

In some embodiments, the account database 104 may provide the user data102 including the activity data objects associated with a user to theprofile database 105 to generate a user interaction profile recordingactivity data objects linked with online behavior data 101 using, e.g.,an entity identifier 113, an activity identifier 114 and a recordresolution engine 112.

In some embodiments, as described above, the content detector 111detects, e.g., an entity associated with a content with which a user hasinteracted on the user computing device 103. In some embodiments, thecontent detector 111 may detect a product or service associated with thecontent, and then an entity associated with the product or service. Thecontent detector 111 may provide the entity associated with the content,such as, e.g., a third-party merchant, as well as, e.g., the product orservice and a date and time at which the interaction was recorded.Similarly, in some embodiments, the activity data of the user data 102may include, e.g., an associated date indicator, an associated entityindicator and an associated activity indicator for each activity dataobjected. For example, in some embodiments, the activity data objectincludes a record of transactions, with, e.g., indicators of the entitywith whom the user transacted, the type of transaction, and the date ortime or both at which the transaction took place. However, otheractivity data objects are also contemplated, such as, e.g., location ornavigation activities, or other non-web-based activities.

In some embodiments, the record resolution engine 112 receives theinteraction data object and the activity data object and groups,automatically and in real-time, user interactions in the interactiondata object with activities in the activity data object that are relatedto each other. In some embodiments, the record resolution may comparedata from each of the activities of the activity data objects and fromeach of the interactions of the interaction data object. For example, insome embodiments, the record resolution engine 112 may utilize a machinelearning model that receives the associated date, entity, product dataor combinations thereof from each of the activity data object and theinteraction data object to determine a correlation between userweb-based interactions and user activities, e.g., transactions topredict activities influenced by the web-based interactions. In someembodiments, the record resolution engine 112 utilizes a set of rules,including, e.g., thresholds such as date thresholds for differencesbetween an activity and a web-based interaction. In some embodiments, acombination of rules and a machine learning model may be used.

In some embodiments, the grouped activity data objects and interactiondata objects may be saved as online interaction groupings withassociated user activities in the profile database 105. In someembodiments, the online interaction groupings may be utilized forsecurity and behavior analysis, among other applications.

For example, in some embodiments, the online interaction groupings maybe provided to a fraud verification engine 121. In some embodiments, auser may input a fraud report, e.g., via the user computing device 103or by some other mechanisms, such as another device, over the telephone,in person, or other method. In some embodiments, the fraud report mayinclude data representing an incorrectly recorded user activity in theuser activity data objects 102. For example, the user activity dataobjects 102 may include records of financial transaction data, such as,e.g., credit card charges, bank account balance transfers, withdrawals,deposits, or other financial transactions and combinations thereof. Theuser may then dispute a transaction recorded in the activity dataobjects 102 as fraudulent or otherwise incorrect, either in amount or ashaving occurred at all.

In some embodiments, the fraud verification engine 121 may receive thedispute from the user and the online interaction groupings from theactivity recognition system 110 and the profile database 105. Where thedisputed activity data object is grouped with one or more onlineinteractions, as represented by the online interaction groupings, thefraud verification engine 121 may return an inquiry to the userincluding a verification message. In some embodiments, the verificationmessage may cause the user computing device 103 or other deviceassociated with the user to display a prompt with a reminder of the oneor more online interactions grouped with the disputed activity dataobject to remind the user of the online interactions, and a request forverification of the dispute. However, where the disputed activity dataobject has no grouped online interactions, the fraud verification engine121 may verify the dispute and process the fraud report to, e.g.,recommend to an administrator or other personnel to cancel the activitydata object from the user's activity data objects 102.

In some instances, the prompt regarding the online interactions mayremind the user of an activity, such as a transaction, that waspreviously unrecognized. In reminding the user of the onlineinteractions, the user may be reminded of the activity such that theuser may rescind the dispute in response to the request forverification. However, the user may still not recognize the activitydata object upon being reminded of the online interactions, and mayconfirm the dispute. The fraud verification engine 121 may verify thedispute and process the fraud report to, e.g., recommend to anadministrator or other personnel to cancel the activity data object fromthe user's activity data objects 102.

In some embodiments, the online interaction groupings may be provided toa fraud detection engine 122. In some embodiments, the onlineinteraction groupings may be used to detect fraud or otherwise erroneousactivity data objects. For example, the fraud detection engine 122 may,e.g., utilize a fraud detection machine learning model to correlateonline interaction groupings with incorrect activity data objects thatdo not have associated online interactions. For example, where theonline interaction groupings include online interactions grouped with,e.g., an activity data object including a purchase of a piece offurniture, the fraud detection engine 122 may mark other activity dataobjects including the purchase of similar pieces of furniture asfraudulent or incorrect. Thus, the fraud detection machine learningmodel may be trained to determine similar activity data objects, whereone of the similar activity data objects having an online interactiongrouping may cause the fraud detection machine learning model to predictan error or fraud in the other similar activity data objects. Such amodel may be combined with other fraud detection techniques, such as,e.g., an activity data object falling outside of a threshold deviationfrom, e.g., a mean or median activity value such as a mean or medianpurchase amount, exceeding a limit on number of activities or a quantityassociated with one or more activities, or other fraud detectiontechnique.

For example, in some embodiments, the fraud detection engine 122 may beemployed in transaction fraud analysis that takes into account userinteractions with any product-related content. In some embodiments, inaddition to fraud analysis for a user transaction, such as, e.g., apurchase of a product, the fraud detection engine 122 may additionallydetermine an interaction and frequency of interaction with contentrelated to the product being purchased as determined by the activityrecognition system 110. Based on the activity data, the fraud detectionengine 122 may increase or decrease a likelihood of fraud of thetransaction. For example, a risk of fraud may be increased where theproduct associated with the transaction is not associated with anyonline behavior data 101 as determined by the activity recognitionsystem 110, or where a date of an interaction with content associatedwith product is far in the past (e.g., 2 weeks, 3 weeks, 1 month, ormore). However, where the online behavior data 101 has been recognizedto be associated with interactions with content associated with theproduct in a recent period (e.g., in the last 2 weeks, in the last week,in the last 4 days, in the last 2 days, in the last day, in the lasthour, etc.), or where such interactions are of a high frequency level(e.g., more than once, more than twice, more than three times, etc.) inthe recent period, the risk of fraud may be determined to be less inresponse to the recency of interactions, frequency of interactions, or acombination thereof.

In some embodiments, the online interaction groupings may be provided toan authentication engine 123. In some embodiments, the user may access,e.g., an online account using an authentication technique such as ausername and password. In some embodiments, the authentication techniquemay include, e.g., multi-factor authentication leveraging the onlineinteraction groupings. For example, the authentication engine 123 maygenerate a message to cause a user device to display an inquiryregarding an activity data objected as a result of an onlineinteraction. For example, the authentication engine 123 may inquire asto what a user purchased upon viewing a particular advertisement orcontent associated with a product, service or brand, or proceedingthrough an online purchase checkout at a particular retailer, or otherinteraction. In some embodiments, the user may then authenticate accessto the online account by correctly identifying an activity associatedwith the activity data object of the appropriate online interactiongrouping.

As an example, embodiments of the authentication engine 123 may employactivity recognition by the activity recognition system 110 of userbehaviors in social media services. For example, the authenticationengine 123 may display a number of recently browsed news, ads, or othercontent posts, e.g., 3, 4, 5 or more content posts. In some embodiments,the authentication engine 123 may use user behaviors from a recent timeperiod such as, e.g., with the past day, within the past two days,within the past week, or other suitable period that a user may reliablyremember. The authentication engine 123 may then display the recentlybrowsed content posts and present, e.g., a series of questions. In someembodiments, the authentication engine 123 may employ a threshold (e.g.,3 out of 3 correct answers) to authenticate based on user responses tothe presented questions. Accordingly, the authentication engine 123provides a real-time behavioral authentication method where correctanswers change continuously through time. As a result, it is harder forfraudsters to crack the authentication. In some embodiments, thequestions may be predetermined, configurable by an administrator,variable (e.g., a subset from a library of questions may be selected forpresentation to a user for authentication), or other technique forproviding authentication questions.

In some embodiments, the online interaction groupings may be provided toan activity analysis engine 124. In some embodiments, the activityanalysis engine 124 may utilize the transaction groupings to determine acorrelation between online interactions and subsequent user activities.For example, the activity analysis engine 124 may evaluate theeffectiveness of advertising on, e.g., social media, using the onlineinteractions with the advertising and user activity data objects, e.g.,purchases, grouped with the online interactions. In some embodiments,the activity analysis engine 124 may determine a similarity between anadvertised product or service by a merchant, and a corresponding useractivity data object of a purchase for the product or service. Where theonline interaction and the user activity data object occur within, e.g.,1 day, 12 hours, 6 hours, 1 hour, or other suitable time frame, of eachother and are associated with a common entity, the activity analysisengine 124 may determine that the content effectively influences theuser activity of the activity data object.

Accordingly, by merging user activity data objects 102 with onlinebehavior data 101 with web-based content, the system of some embodimentsof the present invention may more effectively draw correlations for theinfluence of online content with user activities. The correlations maybe more efficiently and accurately determined because the systems andmethods of embodiments of the present invention may access both useractivity data objects 102 and online behavior data 101, and group thetwo datasets into a profile database 105, forming a unified,comprehensive dataset of user behaviors.

FIG. 2 is a block diagram of another illustrative computer-based systemfor social media data grouping in accordance with one or moreembodiments of the present disclosure.

In some embodiments, an activity recognition system 210, such as theactivity recognition system 110 described above, may include a contentdetector 220 and a record resolution engine 230. In some embodiments,the content detector 220 may receive online behavior data 201. In someembodiments, the content detector 220 may identify user interactionswith online content using an interaction tracker 221. Upon theinteraction tracker 221 detecting behaviors including interactions withmerchant content, such as, e.g., advertisements on a social media page,publication, blog, video, or other web-based content, the interactiontracker 221 may trigger a content source identifier 222 and a contentdata identifier 223 to identify a source of the web-based content andcharacteristics of the content (e.g., date of interaction, associatedproducts, among others), respectively.

In some embodiments, the interaction tracker 221 may including, e.g., alogging mechanism for logging user clicks to determine one what portionsof a web-page or social media page the user clicks. As a result, theinteraction tracker 221 may detect user interactions with content, suchas, e.g., by clicking on advertisements or other merchant content,including sponsored posts, sponsored articles and videos, merchantposts, articles and videos, among others and combinations thereof. Insome embodiments the interaction tracker 221 includes a persistentstorage device such as, e.g., a solid-state drive, hard drive,magnetoresistive drive, server hard drive, cloud storage, or otherpersistent storage device. In some embodiments the interaction tracker221 may temporarily log user interactions with web-based content basedon, e.g., a timer such that the log entries are deleted periodically,such as, e.g., every 15 minutes, every 30 minutes, every hour, everyday, every week, or other period. However, in some embodiments, each logis maintained until the end of a user browsing session, such as, e.g.,by the user closing or exiting the browser, application, or otherinterface for interacting with the content. In some embodiments, theinteraction tracker 221 may store the log in a temporary storage device,such as, e.g., a cache, buffer, random access memory (RAM) or othertemporary storage device.

In some embodiments, interactions with content that is logged by theinteraction tracker 221 may analyzed by the content source identifier222 to identify a source of the content, such as, e.g., an associatedmerchant or marketing entity.

In some embodiments, the content source identifier 222 may include,e.g., image recognition utilizing, e.g., machine learning classifiers,such as a neural network (e.g., convolutional neural network (CNN),recurrent neural network (RNN), artificial neural network (ANN) or otherneural network), a support vector machine, k-Nearest Neighbor, anautoencoder, decision trees, or other machine learning classifier toclassify images of the web-based content. The content source identifier222 may also include, e.g., text recognition, natural languageprocessing or other suitable technique of content identification andcombinations thereof by utilizing, e.g., machine learning classifiers,such as those described above for text recognition and parsing tounderstand text of the web-based content.

In some embodiments, the content source identifier 222 includes a textparsing algorithm to identify matches to a dictionary of particularwords or phrases, such as, e.g., brand names, company names,organization names, products, persons, or other words or phrases. Insome embodiments, the content source identifier 222 may include a tagrecognition algorithm to identify, e.g., tags such as hypertext markuplanguage (HTML) tags. Thus, in some embodiments, where the contentincludes, e.g., an advertisement, the content may include tagsidentifying advertisement details such as an associated merchant, aproduct, a service, among other advertisement details. Using, e.g., textparsing, tag recognition or other content recognition techniques andcombinations thereof, the content source identifier 222 may recognizethe advertisement source to identify, e.g., merchants, or otherassociated entities.

In some embodiments, the content source identifier 222 may include,e.g., a list of known entities, such as, e.g., known merchants. Based onthe entity information determined by, e.g., text or image recognition orHTML tag recognition, as described above, the content source identifier222 may identify whether each interaction in the log is an interactionwith content generated by a merchant. In some embodiments, beforeidentifying the source entity, the content source identifier 222 mayidentify whether the content is branded or sponsored content, such as,e.g., an advertisement, promotion, article, video, post, or othercontent produced by the entity, such as a merchant. However, in someembodiments, the content source identifier 222 may simply be configuredto determine the source and whether that source is a merchant.

In some embodiments, the content detector 222 may directly identifycontent without the use of tags, text parsing or other technique andcombinations thereof. For example, the content detector 222 may be asoftware development kit (SDK) function, such as, e.g., an embedded SDKor embedded mobile SDK that is embedded into an application, webpage,service, platform, or other content management or delivery system. Theembedded SDK may include functionality that automatically receives dataregarding, e.g., advertisements, or other content, such as contentrelated to, e.g., brand names, company names, organization names,products, persons, or other content and third-parties. For example, asocial media platform or network may embed the SDK associated with thecontent detector 222 such that any user interaction with content ofinterest is automatically provided to the content detector 222.

In some embodiments, content of interest that the content detector 222is configured to detect may include, e.g., advertisements, brandedcontent, sponsored content, influencer generated content, contentassociated with a selected subject (e.g., news content, political newscontent, business news content, local news content, media news content,events, meetings, contact information, or other similar content, amongothers and combinations thereof) or other content of interest andcombinations thereof. In some embodiments, the content of interest maybe selectable or configurable by a user or administrator. In someembodiments, the content detector 222 is configured to detect and returndata regarding the content of interest as it appears in, e.g., awebsite, a blog post, a social media feed, a real-simple-syndication(RSS) feed, search engine results, video or audio content, among othermediums and combinations thereof. Accordingly, in some embodiments, thecontent detector 222 may receive, e.g., in real-time, a user'sinteraction with content of interest using, e.g., real-time text and tagparsing, embedded SDK functionality, or other techniques. In someembodiments, where the content detector 222 employs text and tagparsing, the content detector 222 may continually detect userinteractions with content and process the content being interacted withto identify content of interest. However, where the content detector 222is employed in an embedded SDK, the content detector 222 may rely onhost service to receive an indication that the user has interacted withthe content of interest.

In some embodiments, upon identifying the source of the content of eachinteraction, the content source identifier 222 may trigger the contentdata identifier 223 to identify data related to the content, such as,e.g., a product or service, a date of the interaction, a platform onwhich the interaction occurred, among other data. Similar to the contentsource identifier 222, the content data identifier 223 may utilize,e.g., image recognition, text recognition, text parsing, HTML tagidentification, among other recognition techniques and combinationsthereof, to extract the data from the content and the interaction log.Accordingly, the content data identifier 223 may generate tracking dataassociated each interaction, including, e.g., a merchant indicatorindicating the respective merchant of the content, a product indicatorindicating a product associated with the content, an interaction dateindicator indicating a date of each interaction, a platform indicatorindicating a platform on which the interaction occurred, among otherdata.

In some embodiments, upon generating the tracking data, the contentdetector 220 may trigger the record resolution engine 230 to correlateonline interactions of the online behavior data 201 with associatedactivity data of an activity data object 202. In some embodiments, therecord resolution may compare data from each activity data object of theactivity data objects 202 and from each of the interactions of theonline behavior data 201. In some embodiments, the activity data objectseach include an activity data record having an activity type indicatorthat indicates a type of each activity, a related entity indicator thatindicates an entity associated with the activity, and a date indicatorthat indicates a date on which the activity was performed. For example,the activity may include a financial transaction such as a payment forthe purchase of a product or service. As a result, the activity typeindicator may indicate the type of transaction (e.g., payment, transfer,deposit, or other transaction), the related entity indicator mayindicate a merchant or other entity with whom the user transacted, andthe date indicator may indicate the date of the transaction.

In some embodiments, the record resolution engine 230 may groupactivities and interactions based on the online behavior data 201,including the tracking data produced by the content detector 220, andthe activity data records 202. Accordingly, the record resolution engine230 may link online behavior data 201 with associated activities of theuser activity data objects 202 based on a similarity of the interactiondate indicator and the activity date indicator, the merchant and productindicators and the related entity indicators, among other data andcombinations thereof. In some embodiments, the grouping model 231includes, e.g., a classification model, such as those described above,with the online behavior data 201 and tracking data, including merchantindicator, a product indicator, and an interaction date indicator, andthe activity data records 202 including the activity type indicator, therelated entity indicator, and a date indicator that indicates the dateindicator, as an input, and predicts a match probability for eachcombination of the interactions of the online behavior data 201 and theactivities of the activity data objects 202.

However, in some embodiments, the grouping model 231 may be augmented bygrouping rules 232 for training and filtering. In some embodiments, thegrouping model 351 may be assisted by, e.g., filter the online behaviordata 201, tracking data and activity data objects 202 according to adate difference. For example, the grouping model 231 may be applied tocombinations of interactions and activities that are within apredetermined time-frame of each other, such as, e.g., about e.g., 1day, 12 hours, 6 hours, 1 hour, or other suitable time frame. Suchfiltering may assist with training the grouping model 231 by reducingoutliers and noise including combinations of interactions and activitiesthat are not correlated based on date. Moreover, the grouping may bemade more efficient because the grouping model 351 may operate on fewercombinations, thus reducing processing time and resources. The groupingmodel 231 may then better learn to determine correlations using thedates as parameters for grouping.

As a result, the grouping model 231 may predict correlation parametersfor each combination of online interactions with user activities, thecorrelation parameters including the probability of correlationindicating a probability that the online interaction influenced the useractivity of a respective combination. In some embodiments, where theprobability of match exceeds a threshold, such as, e.g., 0.5, 0.7, 0.8,0.9, 0.95, 0.97, 0.99 or other probability, the respective interactionis grouped with the respective activity. Based on the probabilities foreach combination and the threshold, the record resolution engine 230 mayoutput activity correlation data 204 that represents online interactionsthat are correlated with each activity to form grouped activity dataobjects and online behavior records.

In some embodiments, the illustrative embodiments of computer-basedsystems, the illustrative embodiments of computer-based devices, and theillustrative embodiments of computer-based components of the presentdisclosure may be configured to utilize one or more exemplary AI andmachine learning techniques chosen from, but not limited to, decisiontrees, boosting, support-vector machines, neural networks, nearestneighbor algorithms, Naive Bayes, bagging, random forests, and the like.In some embodiments and, optionally, in combination of any embodimentdescribed above or below, an exemplary neutral network technique may beone of, without limitation, feedforward neural network, radial basisfunction network, recurrent neural network, convolutional network (e.g.,U-net) or other suitable network. In some embodiments and, optionally,in combination of any embodiment described above or below, an exemplaryimplementation of Neural Network may be executed as follows:

-   -   i) Define Neural Network architecture or model,    -   ii) Transfer the input data to the exemplary neural network        model,    -   iii) Train the exemplary model incrementally,    -   iv) determine the accuracy for a specific number of timesteps,    -   v) apply the exemplary trained model to process the        newly-received input data,    -   vi) optionally and in parallel, continue to train the exemplary        trained model with a predetermined periodicity.

In some embodiments and, optionally, in combination of any embodimentdescribed above or below, the exemplary trained neural network model mayspecify a neural network by at least a neural network topology, a seriesof activation functions, and connection weights. For example, thetopology of a neural network may include a configuration of nodes of theneural network and connections between such nodes. In some embodimentsand, optionally, in combination of any embodiment described above orbelow, the exemplary trained neural network model may also be specifiedto include other parameters, including but not limited to, bias values,functions or aggregation functions. For example, an activation functionof a node may be a step function, sine function, continuous or piecewiselinear function, sigmoid function, hyperbolic tangent function, or othertype of mathematical function that represents a threshold at which thenode is activated. In some embodiments and, optionally, in combinationof any embodiment described above or below, the exemplary aggregationfunction may be a mathematical function that combines (e.g., sum,product, etc.) input signals to the node. In some embodiments and,optionally, in combination of any embodiment described above or below,an output of the exemplary aggregation function may be used as input tothe exemplary activation function. In some embodiments and, optionally,in combination of any embodiment described above or below, the bias maybe a constant value or function that may be used by the aggregationfunction or the activation function to make the node more or less likelyto be activated.

In some embodiments, the grouped activity data objects and onlinebehavior records may be saved as online interaction groupings withassociated user activities, and the online behavior records sharing acommon activity data object may be merged into a common activitycorrelation record in a user profile in a profile database, such as,e.g., the profile database 105 described above. In some embodiments, theonline interaction groupings may be utilized for security and behavioranalysis, among other applications.

FIG. 3 is a block diagram of another illustrative computer-based systemfor social media data grouping in accordance with one or moreembodiments of the present disclosure.

In some embodiments, a grouping model 351 may receive behavior andtracking data 303, such as, e.g., the online behavior data 201 andtracking data produced by the content detector 220 described above, anduser activity data objects 302, such as the activity data objects 202described above, as input parameters to determine activity correlationdata 304. In some embodiments, the activity data objects each include anactivity data record having an activity type indicator that indicates atype of each activity, a related entity indicator that indicates anentity associated with the activity, and a date indicator that indicatesa date on which the activity was performed. For example, the activitymay include a financial transaction such as a payment for the purchaseof a product or service. As a result, the activity type indicator mayindicate the type of transaction (e.g., payment, transfer, deposit, orother transaction), the related entity indicator may indicate a merchantor other entity with whom the user transacted, and the date indicatormay indicate the date of the transaction. Similarly, in someembodiments, may include, e.g., a merchant indicator indicating therespective merchant of the content, a product indicator indicating aproduct associated with the content, an interaction date indicatorindicating a date of each interaction, a platform indicator indicating aplatform on which the interaction occurred, among other data.

In some embodiments, the grouping model 351 may group onlineinteractions and user activities based on, e.g., an associated entity,an associated quantity or product, and an associated date for eachonline interaction and each user activity data object. Accordingly, insome embodiments, the grouping model 351 may analyze each combination ofan online interaction from the behavior and tracking data 303 and anactivity data object from the activity data objects 302 using an entitymatching module 352, a quantity matching module 353 and a time matchingmodel 354 to determine a probability of a match between the onlineinteraction and the activity data object.

In some embodiments, the entity matching module 352 compares themerchant indicator of the behavior and tracking data 303 with therelated entity indicator of the activity data object 302. For example,in some embodiments, the merchant indicator and the related entityindicator may each include a merchant category code (MCC). However, insome embodiments, one or both of the merchant indicator and the relatedentity indicator may not have the MCC of the associated entity. As aresult, the entity matching module 352 may also include an index of MCCsfor each known entity, e.g., merchant. Accordingly, the entity matchingmodule 352 may extract or determine based on the index the MCC of theentity for each of the merchant indicator and the related entityindicator for the respective interaction-activity combination, anddetermine whether the respective MCCs match. In some embodiments, wherethe MCCs do not match, the combination may be discarded as not beingcorrelated.

In some embodiments, where the entity matching module 352 determinesthat the entity of the merchant indicator of the behavior and trackingdata 303 matches the entity of the related entity indicator of theactivity data object from the activity data objects 302, a quantitymatching module 353 may compare the activity type indicator of theactivity data object with the product indicator of the interaction ofthe behavior and tracking data 303. For example, in some embodiments,the activity type indicator may include, e.g., a transaction type andtransaction amount, such as, e.g., a payment for a quantity of money.Similarly, the product indicator may include a product name or producttype and an associated cost, including, e.g., a retail price, a saleprice, a used price, a refurbished price, or other price andcombinations thereof. In some embodiments, the quantity matching module353 may determine the associated cost of the product indicator by, e.g.,extracting pricing information from the tracking data. The quantitymatching module 353 may compare the pricing determined from the productindicator and the transaction amount associated with the activity typeindicator to determine whether there is match. In some embodiments, amatch is determined where the price and the amount are equivalent.However, sometimes a user may not qualify for a sale price, or may missa sale, or may pay more in tax and shipping, among other variations inpricing. Thus, in some embodiments, the match may be determined wherethe price and the transaction amount are within a threshold quantitydifference, such as, e.g., an average price for shipping, an averageprice for tax, a tax based on a user's location, among other pricevariations and combinations thereof. In some embodiments, the user mayhave purchases multiples of the product, and thus may have a transactionamount for the associated activity type indicator that is a multiple ofprice. Thus, in some embodiments, the quantity matching module 353 mayalso determine a match where the transaction amount is a multiple of theprice, either exactly, or with a threshold quantity difference asdescribed above.

Similar to the entity matching module 352, where the quantity matchingmodule 353 fails to determine a match for a combination, the combinationmay be discarded as not being correlated. However, where a quantitymatch is determined, the time matching model 354 may determine whether asimilarity between the date indicator of the activity of the combinationand the interaction date indicator of the online interaction.

In some embodiments, the time matching model 354 may groupingprobability between the activity and the interaction based on asimilarity of the interaction date indicator and the activity dateindicator using, e.g., a classification model, such as those describedabove. The time matching model 354 may receive each combination ofactivity data object and interaction, using the respective dateindicator and interaction date indicator as input parameters. In someembodiments, the time matching model 354 may analyze the date indicatorand interaction date indicator to generate a grouping probability thatrepresents a probability that the respective activity was influence bythe respective online interaction. For example, the time matching model354 may predict correlation parameters for each combination of onlineinteractions with user activities, the correlation parameters includingthe probability of correlation indicating a probability that the onlineinteraction influenced the user activity of a respective combination. Insome embodiments, where the probability of match exceeds a threshold,such as, e.g., 0.5, 0.7, 0.8, 0.9, 0.95, 0.97, 0.99 or otherprobability, the respective interaction is grouped with the respectiveactivity. Based on the probabilities for each combination and thethreshold, the time matching model 354 may output activity correlationdata 304 that represents online interactions that are correlated witheach activity to form grouped activity data objects and online behaviorrecords.

In some embodiments, the grouped activity data objects and onlinebehavior records may be saved as online interaction groupings withassociated user activities, and the online behavior records sharing acommon activity data object may be merged into a common activitycorrelation record in a user profile in a profile database, such as,e.g., the profile database 105 described above. In some embodiments, theonline interaction groupings may be utilized for security and behavioranalysis, among other applications.

FIG. 4 illustrates a flowchart of another illustrative embodiment ofmethodology for social media data grouping in accordance with one ormore embodiments of the present disclosure.

In some embodiments, a system, including a processing system, for socialmedia data grouping may detect third-party content on a screen, e.g., ofa user computing device, at block 401. In some embodiments, based on thedetected third-party content, an interaction profile of the user isformed and a data link between the interaction profile and activity datarecords associated with the user is generated. In some embodiments, theactivity data records identify entity-related activities performed bythe user, such as, e.g., transactions including purchases of products orservices. In some embodiments, the activity data records include anactivity type indicator that indicates a type of each entity-relatedactivity, a related entity indicator that indicates entities associatedwith each entity-related activity, and a date indicator that indicates adate associated with each entity-related activity.

In some embodiments, the system for social media data grouping maygenerate online interaction data objects, including tracking data atblock 402. In some embodiments, each respective online interaction dataobject of the online interaction data objects includes tracking dataindicative of associated online interactions with content associatedwith a third-party merchant. In some embodiments, the tracking dataassociated with each online interaction includes, a third-party merchantindicator indicating the third-party merchant, a product indicatorindicating a product associated with the content, and an interactiondate indicator indicating a date of each online interaction.

In some embodiments, the system for social media data grouping may logand store the online interaction data objects in a database, at block403. In some embodiments, the online interaction data objects are storedin associated interaction profiles of the user, and stored in, e.g., amemory or storage device including a profile database.

In some embodiments, the system for social media data grouping may groupthe online interaction data objects with activity data records, at block404. In some embodiments, the online interaction data objects aregrouped with the activity data records by utilizing an activity model topredict correlation parameters representing a respective grouping ofonline interactions that are correlated with a respective one or moreactivities of the activity data record using the at least one data link.In some embodiments, the prediction of the correlation parameter isbased, at least in part, on the tracking data of each online interactiondata object associated with the user and each record of accountactivities in the at least one activity data record associated with theuser.

In some embodiments, the system for social media data grouping mayauthenticate a user selection based on the grouping of onlineinteractions, at block 405. In some embodiments, the system for socialmedia data grouping may have received an authentication request inresponse to a user selection at the user computing device. The userselection may cause the system for social media data grouping toauthenticate the user selection based on the groupings of onlineinteractions.

In some embodiments, the authentication authenticates a fraud claim madeby the user selection to generate the authentication based on an accountactivity in the activity data record associated with the user selectionand a correlated grouping of online interactions of the at least oneonline interaction data object.

In some embodiments, the authentication authenticates an accountactivity of the at least one activity data record to generate theauthentication based on each respective grouping of online interactions.

In some embodiments, the authentication authenticates an account accessrequest using a multi-factor authentication selection based on anaccount activity of the at least one activity data record correlatedwith a particular grouping of online interactions of the grouping ofonline interactions of the at least one online interaction data object.

FIG. 5 depicts a block diagram of an exemplary computer-based system 500in accordance with one or more embodiments of the present disclosure.However, not all of these components may be required to practice one ormore embodiments, and variations in the arrangement and type of thecomponents may be made without departing from the spirit or scope ofvarious embodiments of the present disclosure. In some embodiments, theillustrative embodiments of computing devices and the illustrativeembodiments of computing components of the exemplary computer-basedsystem 500 may be configured to manage a large number of members orconcurrent transactions, as detailed herein. In some embodiments, theexemplary computer-based system 500 may be based on a scalable computerand network architecture that incorporates varies strategies forassessing the data, caching, searching, and database connection pooling.An example of the scalable architecture is an architecture that iscapable of operating multiple servers.

In some embodiments, referring to FIG. 5, members 502-504 (e.g.,clients) of the exemplary computer-based system 500 may includevirtually any computing device capable of receiving and sending amessage over a network (e.g., cloud network), such as network 505, toand from another computing device, such as servers 506 and 507, eachother, and the like. In some embodiments, the member devices 502-504 maybe personal computers, multiprocessor systems, microprocessor-based orprogrammable consumer electronics, network PCs, and the like. In someembodiments, one or more member devices within member devices 502-504may include computing devices that typically connect using a wirelesscommunications medium such as cell phones, smart phones, pagers, walkietalkies, radio frequency (RF) devices, infrared (IR) devices, CBs,integrated devices combining one or more of the preceding devices, orvirtually any mobile computing device, and the like. In someembodiments, one or more member devices within member devices 502-504may be devices that are capable of connecting using a wired or wirelesscommunication medium such as a PDA, POCKET PC, wearable computer, alaptop, tablet, desktop computer, a netbook, a video game device, apager, a smart phone, an ultra-mobile personal computer (UMPC), or anyother device that is equipped to communicate over a wired or wirelesscommunication medium (e.g., NFC, RFID, NBIOT, 3G, 4G, 5G, GSM, GPRS,WiFi, WiMax, CDMA, satellite, ZigBee, etc.). In some embodiments, one ormore member devices within member devices 502-504 may include may runone or more applications, such as Internet browsers, mobileapplications, voice calls, video games, videoconferencing, and email,among others. In some embodiments, one or more member devices withinmember devices 502-504 may be configured to receive and to send webpages, and the like. In some embodiments, an exemplary specificallyprogrammed browser application of the present disclosure may beconfigured to receive and display graphics, text, multimedia, and thelike, employing virtually any web based language, including, but notlimited to Standard Generalized Markup Language (SMGL), such asHyperText Markup Language (HTML), a wireless application protocol (WAP),a Handheld Device Markup Language (HDML), such as Wireless MarkupLanguage (WML), WMLScript, XML, JavaScript, and the like. In someembodiments, a member device within member devices 502-504 may bespecifically programmed by either Java, .Net, QT, C, C++ or othersuitable programming language. In some embodiments, one or more memberdevices within member devices 502-504 may be specifically programmedinclude or execute an application to perform a variety of possibletasks, such as, without limitation, messaging functionality, browsing,searching, playing, streaming or displaying various forms of content,including locally stored or uploaded messages, images and video, andgames.

In some embodiments, the exemplary network 505 may provide networkaccess, data transport or other services to any computing device coupledto it. In some embodiments, the exemplary network 505 may include andimplement at least one specialized network architecture that may bebased at least in part on one or more standards set by, for example,without limitation, Global System for Mobile communication (GSM)Association, the Internet Engineering Task Force (IETF), and theWorldwide Interoperability for Microwave Access (WiMAX) forum. In someembodiments, the exemplary network 505 may implement one or more of aGSM architecture, a General Packet Radio Service (GPRS) architecture, aUniversal Mobile Telecommunications System (UMTS) architecture, and anevolution of UMTS referred to as Long Term Evolution (LTE). In someembodiments, the exemplary network 505 may include and implement, as analternative or in conjunction with one or more of the above, a WiMAXarchitecture defined by the WiMAX forum. In some embodiments and,optionally, in combination of any embodiment described above or below,the exemplary network 505 may also include, for instance, at least oneof a local area network (LAN), a wide area network (WAN), the Internet,a virtual LAN (VLAN), an enterprise LAN, a layer 3 virtual privatenetwork (VPN), an enterprise IP network, or any combination thereof. Insome embodiments and, optionally, in combination of any embodimentdescribed above or below, at least one computer network communicationover the exemplary network 505 may be transmitted based at least in parton one of more communication modes such as but not limited to: NFC,RFID, Narrow Band Internet of Things (NBIOT), ZigBee, 3G, 4G, 5G, GSM,GPRS, WiFi, WiMax, CDMA, satellite and any combination thereof. In someembodiments, the exemplary network 505 may also include mass storage,such as network attached storage (NAS), a storage area network (SAN), acontent delivery network (CDN) or other forms of computer or machinereadable media.

In some embodiments, the exemplary server 506 or the exemplary server507 may be a web server (or a series of servers) running a networkoperating system, examples of which may include but are not limited toMicrosoft Windows Server, Novell NetWare, or Linux. In some embodiments,the exemplary server 506 or the exemplary server 507 may be used for orprovide cloud and network computing. Although not shown in FIG. 5, insome embodiments, the exemplary server 506 or the exemplary server 507may have connections to external systems like email, SMS messaging, textmessaging, ad content providers, etc. Any of the features of theexemplary server 506 may be also implemented in the exemplary server 507and vice versa.

In some embodiments, one or more of the exemplary servers 506 and 507may be specifically programmed to perform, in non-limiting example, asauthentication servers, search servers, email servers, social networkingservices servers, SMS servers, IM servers, MMS servers, exchangeservers, photo-sharing services servers, advertisement providingservers, financial or banking-related services servers, travel servicesservers, or any similarly suitable service-base servers for users of themember computing devices 501-504.

In some embodiments and, optionally, in combination of any embodimentdescribed above or below, for example, one or more exemplary computingmember devices 502-504, the exemplary server 506, or the exemplaryserver 507 may include a specifically programmed software module thatmay be configured to send, process, and receive information using ascripting language, a remote procedure call, an email, a tweet, ShortMessage Service (SMS), Multimedia Message Service (MMS), instantmessaging (IM), internet relay chat (IRC), mIRC, Jabber, an applicationprogramming interface, Simple Object Access Protocol (SOAP) methods,Common Object Request Broker Architecture (CORBA), HTTP (HypertextTransfer Protocol), REST (Representational State Transfer), or anycombination thereof.

FIG. 6 depicts a block diagram of another exemplary computer-basedsystem 600 in accordance with one or more embodiments of the presentdisclosure. However, not all of these components may be required topractice one or more embodiments, and variations in the arrangement andtype of the components may be made without departing from the spirit orscope of various embodiments of the present disclosure. In someembodiments, the member computing devices 602 a, 602 b thru 602 n showneach at least includes a computer-readable medium, such as arandom-access memory (RAM) 608 coupled to a processor 610 or FLASHmemory. In some embodiments, the processor 610 may executecomputer-executable program instructions stored in memory 608. In someembodiments, the processor 610 may include a microprocessor, an ASIC, ora state machine. In some embodiments, the processor 610 may include, ormay be in communication with, media, for example computer-readablemedia, which stores instructions that, when executed by the processor610, may cause the processor 610 to perform one or more steps describedherein. In some embodiments, examples of computer-readable media mayinclude, but are not limited to, an electronic, optical, magnetic, orother storage or transmission device capable of providing a processor,such as the processor 610 of client 602 a, with computer-readableinstructions. In some embodiments, other examples of suitable media mayinclude, but are not limited to, a floppy disk, CD-ROM, DVD, magneticdisk, memory chip, ROM, RAM, an ASIC, a configured processor, alloptical media, all magnetic tape or other magnetic media, or any othermedium from which a computer processor can read instructions. Also,various other forms of computer-readable media may transmit or carryinstructions to a computer, including a router, private or publicnetwork, or other transmission device or channel, both wired andwireless. In some embodiments, the instructions may comprise code fromany computer-programming language, including, for example, C, C++,Visual Basic, Java, Python, Perl, JavaScript, and etc.

In some embodiments, member computing devices 602 a through 602 n mayalso comprise a number of external or internal devices such as a mouse,a CD-ROM, DVD, a physical or virtual keyboard, a display, a speaker, orother input or output devices. In some embodiments, examples of membercomputing devices 602 a through 602 n (e.g., clients) may be any type ofprocessor-based platforms that are connected to a network 606 such as,without limitation, personal computers, digital assistants, personaldigital assistants, smart phones, pagers, digital tablets, laptopcomputers, Internet appliances, and other processor-based devices. Insome embodiments, member computing devices 602 a through 602 n may bespecifically programmed with one or more application programs inaccordance with one or more principles and methodologies detailedherein. In some embodiments, member computing devices 602 a through 602n may operate on any operating system capable of supporting a browser orbrowser-enabled application, such as Microsoft™, Windows™, or Linux. Insome embodiments, member computing devices 602 a through 602 n shown mayinclude, for example, personal computers executing a browser applicationprogram such as Microsoft Corporation's Internet Explorer™, AppleComputer, Inc.'s Safari™, Mozilla Firefox, or Opera. In someembodiments, through the member computing client devices 602 a through602 n, users, 612 a through 602 n, may communicate over the exemplarynetwork 606 with each other or with other systems and devices coupled tothe network 606. As shown in FIG. 6, exemplary server devices 604 and613 may be also coupled to the network 606. In some embodiments, one ormore member computing devices 602 a through 602 n may be mobile clients.

In some embodiments, at least one database of exemplary databases 607and 615 may be any type of database, including a database managed by adatabase management system (DBMS). In some embodiments, an exemplaryDBMS-managed database may be specifically programmed as an engine thatcontrols organization, storage, management, and retrieval of data in therespective database. In some embodiments, the exemplary DBMS-manageddatabase may be specifically programmed to provide the ability to query,backup and replicate, enforce rules, provide security, compute, performchange and access logging, and automate optimization. In someembodiments, the exemplary DBMS-managed database may be chosen fromOracle database, IBM DB2, Adaptive Server Enterprise, FileMaker,Microsoft Access, Microsoft SQL Server, MySQL, PostgreSQL, and a NoSQLimplementation. In some embodiments, the exemplary DBMS-managed databasemay be specifically programmed to define each respective schema of eachdatabase in the exemplary DBMS, according to a particular database modelof the present disclosure which may include a hierarchical model,network model, relational model, object model, or some other suitableorganization that may result in one or more applicable data structuresthat may include fields, records, files, and objects. In someembodiments, the exemplary DBMS-managed database may be specificallyprogrammed to include metadata about the data that is stored.

In some embodiments, the illustrative embodiments of computer-basedsystems of the present disclosure may be specifically configured tooperate in a cloud computing architecture such as, but not limiting to:infrastructure a service (IaaS), platform as a service (PaaS), andsoftware as a service (SaaS). FIGS. 7 and 8 illustrate schematics ofexemplary implementations of the cloud computing architecture(s) inwhich the illustrative embodiments of computer-based systems of thepresent disclosure may be specifically configured to operate.

At least some aspects of the present disclosure will now be describedwith reference to the following numbered clauses.

1. A method comprising:

receiving, by at least one processor, an authentication request inresponse to a user selection at a user computing device associated witha user;

generating, by the at least one processor, at least one data linkbetween:

-   -   i) a stored interaction profile of the user and    -   ii) at least one activity data record that identifies at least        one entity-related activity performed by the user;    -   wherein the stored interaction profile is stored in at least one        profile database;    -   wherein the at least one activity data record comprises:        -   i) an activity type indicator that indicates a type of each            respective entity-related activity of the at least one            entity-related activity,        -   ii) a related entity indicator that indicates at least one            entity associated with each respective entity-related            activity of the at least one entity-related activity, and        -   iii) a date indicator that indicates a date associated with            each respective entity-related activity of the at least one            entity-related activity;

receiving, by the at least one processor, at least one onlineinteraction data object associated with the user;

-   -   wherein each respective online interaction data object of the at        least one online interaction data object comprises tracking data        indicative of a respective at least one online interaction with        content associated with a respective third-party merchant;    -   wherein the tracking data associated with each respective at        least one online interaction comprises:        -   i) a third-party merchant indicator indicating the            respective third-party merchant,        -   ii) a product indicator indicating a product associated with            the content, and        -   iii) an interaction date indicator indicating a date of each            online interaction;

storing, by the at least one processor, the at least one onlineinteraction data object in the stored interaction profile associatedwith the user;

utilizing, by the at least one processor, an activity model to predictat least one correlation parameter representing a respective grouping ofonline interactions of the at least one online interaction data objectthat are correlated with a respective one or more activities of theactivity data record using the at least one data link;

-   -   wherein the prediction of the correlation parameter is based at        least in part on the tracking data of each respective online        interaction data object of the at least one online interaction        data object associated with the user and each record of account        activities in the at least one activity data record associated        with the user;

updating, by the at least one processor, the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link; and

causing to display, by the at least one processor, an authentication ofthe user selection in response to the authentication request based onthe respective grouping of online interactions.

2. The method of clause 1, further comprising authenticating, by the atleast one processor, a fraud clause made by the user selection togenerate the authentication based on an account activity of the at leastone activity data record associated with the user selection and acorrelated grouping of online interactions of the at least one onlineinteraction data object.3. The method of clause 1, further comprising authenticating, by the atleast one processor, an account activity of the at least one activitydata record to generate the authentication based on each respectivegrouping of online interactions.4. The method of clause 1, further comprising authenticating, by the atleast one processor, the user selection comprising an account accessrequest using a multi-factor authentication selection based on anaccount activity of the at least one activity data record correlatedwith a particular grouping of online interactions of the grouping ofonline interactions of the at least one online interaction data object.5. The method of clause 1, further comprising:

receiving, by the at least one processor, the content associated witheach respective at least one online interaction; and

generating, by the at least one processor, the tracking data associatedwith each respective at least one online interaction based on arecognition of the content obtained from an image recognition model.

6. The method of clause 1, further comprising:

receiving, by the at least one processor, the content associated witheach respective at least one online interaction; and

extracting, by the at least one processor, the tracking data associatedwith each respective at least one online interaction from tagsassociated with the content.

7. The method of clause 1, wherein one or more online interactions ofthe at least one online interaction comprises a purchase associated withthe content of each respective at least one online interaction; and

wherein the content of each respective at least one online interactioncomprises an online checkout page associated with a product of thethird-party merchant.

8. The method of clause 1, wherein the content of each respective atleast one online interaction comprises an advertisement.

9. The method of clause 1, wherein the content of each respective atleast one online interaction comprises user generated content havingimages of at least one product associated with the third-party merchant.

10. The method of clause 1, further comprising utilizing, by the atleast one processor, the account activity model to predict thecorrelation parameter based at least in part on each respectiveinteraction date indicator indicating a date within a predeterminedperiod of each respective date indicator of each respective accountactivity of the account activities; and

wherein the predetermined period is based at least in part on a saleperiod defined in the content associated with each respective at leastone online interaction.

11. A method comprising:

receiving, by at least one processor, an online interaction by a userwith content associated with a third-party merchant;

-   -   wherein the online interaction comprises tracking data;    -   wherein the tracking data comprises:        -   i) a third-party merchant indicator indicating the            third-party merchant associated,        -   ii) a product indicator indicating a product associated with            the content, and        -   iii) an interaction date indicator indicating a date of each            online interaction;

storing, by the at least one processor, the online interaction in anonline interaction data object associated with the user;

utilizing, by the at least one processor, an account activity model topredict a correlation parameter representing a grouping of the onlineinteraction with one or more entity-related activities of at least oneactivity data record associated with the user based at least in part onthe tracking data and each entity-related activity in the at least oneactivity data record;

-   -   wherein each entity-related activity comprises:        -   i) an activity type indicator that indicates a type of each            respective entity-related activity of the one or more            entity-related activities,        -   ii) a related entity indicator that indicates at least one            entity associated with each respective entity-related            activity of the one or more entity-related activities, and        -   iii) a date indicator that indicates a date associated with            each respective entity-related activity of the one or more            entity-related activities;

updating, by the at least one processor, the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link; and

causing to display, by the at least one processor, an authentication ofa user selection based on the correlation parameter representing thegrouping of the online interaction with the one or more entity-relatedactivities.

12. The method of clause 11, further comprising authenticating, by theat least one processor, a fraud clause made by the user selection togenerate the authentication based on the correlation parameter.

13. The method of clause 11, further comprising authenticating, by theat least one processor, the entity-related activity of the at least oneactivity data record to generate the authentication based on thecorrelation parameter.

14. The method of clause 11, further comprising authenticating, by theat least one processor, the user selection comprising an account accessrequest using a multi-factor authentication selection based on theentity-related activity of the at least one activity data recordcorrelated with the online interaction.15. The method of clause 11, further comprising:

receiving, by the at least one processor, the content associated withthe online interaction; and

generating, by the at least one processor, the tracking data associatedwith the online interaction based on a recognition of the contentobtained from an image recognition model.

16. The method of clause 11, further comprising:

receiving, by the at least one processor, the content associated withthe online interaction; and

extracting, by the at least one processor, the tracking data associatedwith the online interaction from tags associated with the content.

17. The method of clause 11, wherein the online interaction comprises apurchase associated with the content; and

wherein the content of the online interaction comprises an onlinecheckout page associated with a product of the third-party merchant.

18. The method of clause 11, wherein the content comprises usergenerated content having images of at least one product associated withthe third-party merchant.

19. The method of clause 11, further comprising utilizing, by the atleast one processor, the account activity model to predict thecorrelation parameter based at least in part on the interaction dateindicator indicating a date within a predetermined period of eachrespective date indicator of each respective one or more entity-relatedactivities of the at least one activity data record; and

wherein the predetermined period is based at least in part on a saleperiod defined in the content associated with the online interaction.

20. A system comprising:

at least one activity database configured to store an at least oneactivity data record associated with a user;

at least one profile database configured to store a stored interactionprofile associated with the user;

at least one processor in communication with the account database andthe online interaction database; and

wherein the at least one processor is configured to:

-   -   receive an authentication request in response to a user        selection at a user computing device associated with a user;    -   generate at least one data link between:        -   i) a stored interaction profile of the user and        -   ii) at least one activity data record that identifies at            least one entity-related activity performed by the user;        -   wherein the stored interaction profile is stored in the at            least one profile database;        -   wherein the at least one activity data record comprises:            -   i) an activity type indicator that indicates a type of                each respective entity-related activity of the at least                one entity-related activity,            -   ii) a related entity indicator that indicates at least                one entity associated with each respective                entity-related activity of the at least one                entity-related activity, and            -   iii) a date indicator that indicates a date associated                with each respective entity-related activity of the at                least one entity-related activity;    -   receive at least one online interaction data object associated        with the user;        -   wherein each respective online interaction data object of            the at least one online interaction data object comprises            tracking data indicative of a respective at least one online            interaction with content associated with a respective            third-party merchant;        -   wherein the tracking data associated with each respective at            least one online interaction comprises:            -   i) a third-party merchant indicator indicating the                respective third-party merchant,            -   ii) a product indicator indicating a product associated                with the content, and            -   iii) an interaction date indicator indicating a date of                each online interaction;    -   store the at least one online interaction data object in the        stored interaction profile associated with the user;    -   utilize an activity model to predict at least one correlation        parameter representing a respective grouping of online        interactions of the at least one online interaction data object        that are correlated with a respective one or more activities of        the data record using the at least one data link;        -   wherein the prediction of the correlation parameter is based            at least in part on the tracking data of each respective            online interaction data object of the at least one online            interaction data object associated with the user and each            record of account activities in the at least one activity            data record associated with the user;    -   update the stored interaction profile associated with the user        based on each respective grouping of the respective online        interactions of the at least one online interaction data object        and the respective one or more activities of the activity data        record using the at least one data link; and    -   cause to display an authentication of the user selection in        response to the authentication request based on the respective        grouping of online interactions.

While one or more embodiments of the present disclosure have beendescribed, it is understood that these embodiments are illustrativeonly, and not restrictive, and that many modifications may becomeapparent to those of ordinary skill in the art, including that variousembodiments of the inventive methodologies, the inventive systems, andthe inventive devices described herein can be utilized in anycombination with each other. Further still, the various steps may becarried out in any desired order (and any desired steps may be added andany desired steps may be eliminated).

The invention claimed is:
 1. A method comprising: receiving, by at leastone processor, an authentication request in response to a user selectionat a user computing device associated with a user; generating, by the atleast one processor, at least one data link between: i) a storedinteraction profile of the user, and ii) at least one activity datarecord that identifies at least one entity-related activity performed bythe user; wherein the stored interaction profile is stored in at leastone profile database; wherein the at least one activity data recordcomprises: i) an activity type indicator that indicates a type of eachrespective entity-related activity of the at least one entity-relatedactivity, ii) a related entity indicator that indicates at least oneentity associated with each respective entity-related activity of the atleast one entity-related activity, and iii) a date indicator thatindicates a date associated with each respective entity-related activityof the at least one entity-related activity; receiving, by the at leastone processor, at least one online interaction data object associatedwith the user; wherein each respective online interaction data object ofthe at least one online interaction data object comprises tracking dataindicative of a respective at least one online interaction with contentassociated with a respective third-party merchant; wherein the trackingdata associated with each respective at least one online interactioncomprises: i) a third-party merchant indicator indicating the respectivethird-party merchant, ii) a product indicator indicating a productassociated with the content, and iii) an interaction date indicatorindicating a date of each online interaction; storing, by the at leastone processor, the at least one online interaction data object in thestored interaction profile associated with the user; utilizing, by theat least one processor, an activity model to predict at least onecorrelation parameter representing a respective grouping of onlineinteractions of the at least one online interaction data object that arecorrelated with a respective one or more activities of the activity datarecord using the at least one data link; wherein the prediction of thecorrelation parameter is based at least in part on the tracking data ofeach respective online interaction data object of the at least oneonline interaction data object associated with the user and each recordof account activities in the at least one activity data recordassociated with the user; updating, by the at least one processor, thestored interaction profile associated with the user based on eachrespective grouping of the respective online interactions of the atleast one online interaction data object and the respective one or moreactivities of the activity data record using the at least one data link;and causing to display, by the at least one processor, an authenticationof the user selection in response to the authentication request based onthe respective grouping of online interactions.
 2. The method of claim1, further comprising authenticating, by the at least one processor, afraud claim made by the user selection to generate the authenticationbased on an account activity of the at least one activity data recordassociated with the user selection and a correlated grouping of onlineinteractions of the at least one online interaction data object.
 3. Themethod of claim 1, further comprising authenticating, by the at leastone processor, an account activity of the at least one activity datarecord to generate the authentication based on each respective groupingof online interactions.
 4. The method of claim 1, further comprisingauthenticating, by the at least one processor, the user selectioncomprising an account access request using a multi-factor authenticationselection based on an account activity of the at least one activity datarecord correlated with a particular grouping of online interactions ofthe grouping of online interactions of the at least one onlineinteraction data object.
 5. The method of claim 1, further comprising:receiving, by the at least one processor, the content associated witheach respective at least one online interaction; and generating, by theat least one processor, the tracking data associated with eachrespective at least one online interaction based on a recognition of thecontent obtained from an image recognition model.
 6. The method of claim1, further comprising: receiving, by the at least one processor, thecontent associated with each respective at least one online interaction;and extracting, by the at least one processor, the tracking dataassociated with each respective at least one online interaction fromtags associated with the content.
 7. The method of claim 1, wherein oneor more online interactions of the at least one online interactioncomprises a purchase associated with the content of each respective atleast one online interaction; and wherein the content of each respectiveat least one online interaction comprises an online checkout pageassociated with a product of the third-party merchant.
 8. The method ofclaim 1, wherein the content of each respective at least one onlineinteraction comprises an advertisement.
 9. The method of claim 1,wherein the content of each respective at least one online interactioncomprises user generated content having images of at least one productassociated with the third-party merchant.
 10. The method of claim 1,further comprising utilizing, by the at least one processor, the accountactivity model to predict the correlation parameter based at least inpart on each respective interaction date indicator indicating a datewithin a predetermined period of each respective date indicator of eachrespective account activity of the account activities; and wherein thepredetermined period is based at least in part on a sale period definedin the content associated with each respective at least one onlineinteraction.
 11. A method comprising: receiving, by at least oneprocessor, an online interaction by a user with content associated witha third-party merchant; wherein the online interaction comprisestracking data; wherein the tracking data comprises: i) a third-partymerchant indicator indicating the third-party merchant associated, ii) aproduct indicator indicating a product associated with the content, andiii) an interaction date indicator indicating a date of each onlineinteraction; storing, by the at least one processor, the onlineinteraction in an online interaction data object associated with theuser; utilizing, by the at least one processor, an account activitymodel to predict a correlation parameter representing a grouping of theonline interaction with one or more entity-related activities of atleast one activity data record associated with the user based at leastin part on the tracking data and each entity-related activity in the atleast one activity data record; wherein each entity-related activitycomprises: i) an activity type indicator that indicates a type of eachrespective entity-related activity of the one or more entity-relatedactivities, ii) a related entity indicator that indicates at least oneentity associated with each respective entity-related activity of theone or more entity-related activities, and iii) a date indicator thatindicates a date associated with each respective entity-related activityof the one or more entity-related activities; updating, by the at leastone processor, the stored interaction profile associated with the userbased on each respective grouping of the respective online interactionsof the at least one online interaction data object and the respectiveone or more activities of the activity data record using the at leastone data link; and causing to display, by the at least one processor, anauthentication of a user selection based on the correlation parameterrepresenting the grouping of the online interaction with the one or moreentity-related activities.
 12. The method of claim 11, furthercomprising authenticating, by the at least one processor, a fraud claimmade by the user selection to generate the authentication based on thecorrelation parameter.
 13. The method of claim 11, further comprisingauthenticating, by the at least one processor, the entity-relatedactivity of the at least one activity data record to generate theauthentication based on the correlation parameter.
 14. The method ofclaim 11, further comprising authenticating, by the at least oneprocessor, the user selection comprising an account access request usinga multi-factor authentication selection based on the entity-relatedactivity of the at least one activity data record correlated with theonline interaction.
 15. The method of claim 11, further comprising:receiving, by the at least one processor, the content associated withthe online interaction; and generating, by the at least one processor,the tracking data associated with the online interaction based on arecognition of the content obtained from an image recognition model. 16.The method of claim 11, further comprising: receiving, by the at leastone processor, the content associated with the online interaction; andextracting, by the at least one processor, the tracking data associatedwith the online interaction from tags associated with the content. 17.The method of claim 11, wherein the online interaction comprises apurchase associated with the content; and wherein the content of theonline interaction comprises an online checkout page associated with aproduct of the third-party merchant.
 18. The method of claim 11, whereinthe content comprises user generated content having images of at leastone product associated with the third-party merchant.
 19. The method ofclaim 11, further comprising utilizing, by the at least one processor,the account activity model to predict the correlation parameter based atleast in part on the interaction date indicator indicating a date withina predetermined period of each respective date indicator of eachrespective one or more entity-related activities of the at least oneactivity data record; and wherein the predetermined period is based atleast in part on a sale period defined in the content associated withthe online interaction.
 20. A system comprising: at least one activitydatabase configured to store an at least one activity data recordassociated with a user; at least one profile database configured tostore a stored interaction profile associated with the user; at leastone processor in communication with the account database and the onlineinteraction database; and wherein the at least one processor isconfigured to: receive an authentication request in response to a userselection at a user computing device associated with a user; generate atleast one data link between: i) a stored interaction profile of the userand ii) at least one activity data record that identifies at least oneentity-related activity performed by the user; wherein the storedinteraction profile is stored in the at least one profile database;wherein the at least one activity data record comprises: i) an activitytype indicator that indicates a type of each respective entity-relatedactivity of the at least one entity-related activity, ii) a relatedentity indicator that indicates at least one entity associated with eachrespective entity-related activity of the at least one entity-relatedactivity, and iii) a date indicator that indicates a date associatedwith each respective entity-related activity of the at least oneentity-related activity; receive at least one online interaction dataobject associated with the user; wherein each respective onlineinteraction data object of the at least one online interaction dataobject comprises tracking data indicative of a respective at least oneonline interaction with content associated with a respective third-partymerchant; wherein the tracking data associated with each respective atleast one online interaction comprises: i) a third-party merchantindicator indicating the respective third-party merchant, ii) a productindicator indicating a product associated with the content, and iii) aninteraction date indicator indicating a date of each online interaction;store the at least one online interaction data object in the storedinteraction profile associated with the user; utilize an activity modelto predict at least one correlation parameter representing a respectivegrouping of online interactions of the at least one online interactiondata object that are correlated with a respective one or more activitiesof the data record using the at least one data link; wherein theprediction of the correlation parameter is based at least in part on thetracking data of each respective online interaction data object of theat least one online interaction data object associated with the user andeach record of account activities in the at least one activity datarecord associated with the user; update the stored interaction profileassociated with the user based on each respective grouping of therespective online interactions of the at least one online interactiondata object and the respective one or more activities of the activitydata record using the at least one data link; and cause to display anauthentication of the user selection in response to the authenticationrequest based on the respective grouping of online interactions.